JP2001117885A - Client server system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a client server system by which a communication speed being the same as that of a double-layer system is obtained even when a triple- layer system is constituted. SOLUTION: A client AP 11 stored in a web server 1 is down-loaded to a client device 2 in the case of a job processing. An initialization processing part 11a corrects a security information file 21a and releases the limit of a communication route which is restricted to be by way of the web server 1. The client device 2 directly executes communication with a job server 3 by the communication speed being equal to that of the double-layer system.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a client server system applicable to a three-tier client server system and the like.

[0002]

2. Description of the Related Art In recent years, a three-layer C / S system is often used instead of a two-layer client / server system (C / S system).

[0003] The two-layer C / S system is composed of a business server that provides processing related to business and a client device that requests the business server for processing.
The S system is a two-layer C / S system with a web server (Wo
rld Wide Web Server), and by storing application program files for client devices (hereinafter simply referred to as client AP) and communication module and other program files in this server in a downloadable state. ,
It enables remote installation of software, initial settings, and upgrades of functions.

FIG. 6 is a diagram showing a configuration of a conventional three-layer C / S system.

[0005] In FIG. 6, a three-layer C / S system is composed of a web server 1, a client device 2, and a business server 3.

The web server 1 includes a storage device such as a hard disk device (not shown), and a client AP 13 for performing data input / output processing and a communication module 12 for performing communication processing are provided to the client device 2. It is stored so that it can be supplied. The client device 2
It includes an input device and a display device (both not shown), and has a web browser 21 for browsing information through the web server 1. The business server 3 includes an application program file (hereinafter simply abbreviated as “server AP”) 31 for performing a process (database processing or the like) requested by the client device 2 and a client device 2 with the execution of the server AP 31. A communication module 32 for executing communication processing is mounted.

Generally, a plurality of client devices 2
The web server 1 is installed at a ratio of one.

In such a conventional C / S system, when a web browser 21 is started in the client device 2 at the start of business processing, the web server 1
The client AP 13 and the communication module 12 are supplied to the client device 2, and the client device 2 downloads and installs these files. Each of the files after the installation is provided to the client AP1.
3A and communication module 12A.

When the client AP 13A is executed, the communication module 12A and the communication module 32
, Online processing (communication processing) between the client device 2 and the business server 3 is performed.

[0010] In this case, the communication path is limited to only via the web server 1 from which the file is downloaded in order to ensure security.
Communication protocols such as HTTP (Hyper Text Transfer Protocol) and tunneling protocol are used.

[0011]

However, the following problems have been pointed out in the above-mentioned conventional three-tier client server system.

That is, the communication path from the client device 2 to the business server 3 is a web server 1
Since the communication is limited to via the Internet, communication to the business server 3 cannot be performed directly, which is an obstacle to realizing high-speed communication.

[0013] In addition, since the HTTP or the tunneling protocol having a low processing speed is used when passing through the web server 1, the communication speed inherent in the communication module may not be obtained.

Further, since the number of web servers is smaller than the number of client devices, the load of communication processing on the web server is large, and therefore, the communication speed tends to be lower than in the two-layer system. .

In view of the above, the present invention has been made in view of the above-mentioned problems, and an object of the present invention is to provide a client capable of obtaining a communication speed equivalent to that of a two-layer system even when a three-layer system is configured. It is to provide a server system.

[0016]

According to a first aspect of the present invention, there is provided a client server system including a web server having a client device program file and a communication module, and at least a web browser. A client device that obtains a client device program file and a communication module from the web server, and directly communicates with a predetermined business server using the obtained client device program file and the communication module. It is characterized by the following.

According to the first aspect of the present invention, a program file for a client device and a communication module are stored in the web server in advance, and at least the client device equipped with a web browser is appropriately connected to the web server. From the client device program file and the communication module obtained from the client device, and directly communicates with a predetermined business server using the obtained client device program file and the communication module. However, a communication speed equivalent to that of the two-layer system is obtained.

According to a second aspect of the present invention, in the client-server system according to the first aspect, the program file for the client device cancels a restriction on a communication path limited to via the web server. There is a feature.

According to the second aspect of the present invention, when the communication path from the client device is limited to via a web server in order to ensure security, the program file for the client device is By releasing the restriction on the communication path, communication with the business server can be performed directly.

According to a third aspect of the present invention, in the client server system according to the first or second aspect, the program file for the client device is encrypted so as to be decryptable in the client device. It is characterized by having.

According to the third aspect of the present invention, a file other than a legitimate client device program file cannot be decrypted by the client device, so that an illegally created file cannot be executed. Like that.

[0022]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of a client server system according to the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing the configuration of the client server system according to the first embodiment. In FIG.
Web server 1, client device 2, and business server 3
Are shown as a three-tier client-server system.

The web server 1 has a client AP which is an application program for a client device.
11 and a communication module 12 are stored. These are program files called “Java applet”, which are compressed on the web server 1. The communication module 12 is, specifically, an ORB
(Object Request Broker), which enables high-speed communication between ORBs.

The client device 2 includes an input device and a display device (both not shown) and the like, and has a web browser 21 mounted thereon. Also, the client device 2
Contains a security information file 2 for writing changes to the standard settings of the web browser 21.
1a is stored. The security information file 21a is attached to the web browser 21 as a standard, or is installed in the client device 2 via a network as appropriate.

The web browser 21 according to the present embodiment operates according to the standard settings of the web browser 21 and the contents of the security information file 21a. Although not shown, the web browser 21 is equipped with a decompression module for decompressing the compressed program file and a translation module for translating the decompressed program file. These decompression modules and translation modules can be supplied via a network.

FIG. 2 shows the security information file 21a.
It is a figure showing the example of description of. In the "security class" portion in FIG. 2, descriptions called "permission classes" such as "communication access permission", "file access permission", and "access permission for all" are made. In the “target” part, descriptions of access targets such as “business server”, “file”, and “directory” are made. "motion"
The type of operation such as “connection permitted”, “read”, and “write” is described in the part.

As shown in FIG. 1, the client AP 11 includes an initialization processing section 11a for performing initialization processing when executed on the web browser 21, and an application execution section 11b for performing processing relating to data input / output. The security information file 21a is rewritten and corrected by the initialization processing unit 11a.

That is, the above-described initialization processing unit 11a of the client AP 11 writes the description of “communication access permission”, “business server”, and “connection permission” in the corresponding portions of the security information file 21a shown in FIG. By doing so, the restriction on the communication path in the client device 2 can be released.

Returning to FIG. 1, the business server 3 is equipped with a server AP 31 for performing database processing and the like relating to business, and a communication module 32 which is the above-mentioned ORB. The client AP 11 and the communication module 12
Is downloaded to the client device 2,
It is decompressed by a decompression module mounted on the web browser 21, and is translated and executed by a translation module also mounted on the web browser 21.

Next, the flow of processing in the first embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing the flow of processing in the client device 2. In step S <b> 1, the client device 2 downloads the security information file 21 a from the web server 1. This download is a process performed as a preparation for operating this system, and is unnecessary when the security information file 21a is already stored in the client device 2.

In step S3, an operating system is started when the power of the client device 2 is turned on. Then, at the start of the work in the client device 2, first, the web browser 21 is activated (step S5).

In step S 7, the client device 2 downloads the client AP 11 and the communication module 12 from the web server 1 in response to a request from the web browser 21. Note that these program files are temporarily read into the cache memory in the client device 2, and thereafter, the process is executed for each step called from the cache memory.

Then, in step S9, the initialization processing unit 11a of the client AP 11 makes the above-described modification to the security information file 21a. If the same content has already been corrected, this correction is not performed.

As a result of this modification, the restriction on the communication path, which has been restricted only via the web server 1, is removed, and online processing with the business server 3 is performed without passing through the web server 1. Therefore, in the system according to the present embodiment, high-speed communication processing can be realized at the original speed of the communication module.

When the business process is completed and the power of the client device 2 is turned off, the contents in the cache memory are erased. Then, at the time of the next business operation, the program file is downloaded again. Therefore, by always storing the latest program file in the web server 1, the system user can always use the latest software.

Therefore, according to the first embodiment of the present invention, the program file for the client device and the communication module are stored in the web server, and the client device can appropriately transmit the program file for the client device and the communication file from the web server. Since the communication module is obtained and the communication with the business server is directly performed by using the obtained file, the convenience of the three-layer client server system in which a program file or the like can be supplied to the client device as needed is lost. Thus, high-speed communication equivalent to that of a two-layer system can be realized.

Further, since there is no need to provide a facility for using the tunneling protocol in the web server 1, the web server 1 can be simplified.

By the way, in the first embodiment,
In order to release the restriction on the communication path, the security information file 21a is modified. For example, an invalid file is sent to the client device 2 and the contents of the security information file 21a and the like in the client device 2 are modified. A situation in which the setting contents and data are falsified may occur.

Therefore, in a second embodiment of the present invention,
In order to prevent such a situation, the client AP 11 and the communication module 12 are encrypted so that the client device 2 can decrypt them.

FIG. 4 is a sequence diagram showing a flow of processing in the second embodiment, and FIG. 5 is a diagram showing a flow of information on a network.

In FIG. 5, reference numeral 1000 denotes a public key certificate authority that authenticates the public key in response to a public key registration application and issues a digitally signed certificate 1001. Reference numeral 21b denotes a key store file for storing a public key authenticated by the public key certificate authority 1000, and is used by the web browser 21.

Next, the operation in this embodiment will be described with reference to FIGS.

In step S21 of FIG. 4, a registration request for the public key A is made to the public key certificate authority 1000 by a system administrator or the like. In step S23, the public key certificate authority 1000 authenticates the public key A. In subsequent step S25, the public key certificate authority 1000 issues a certificate 1001. The certificate 1001 contains the public key A, and is digitally signed by the public key certificate authority 1000.

In step S27, a certificate 1001 is distributed to the client device 2 via a network or the like by a system administrator or the like. In step S29,
The client device 2 obtains the certificate 1001. In step S31, the client device 2 decrypts the certificate 1001 with the public key of the public key certificate authority 1000 already stored in the client device 2, and obtains the public key A Take out. Then, in step S33, the client device 2 saves and registers the public key A in the key store file 21b.

On the other hand, in step S35, as shown in FIG. 5, the private key B paired with the public key A authenticated by the public key certificate authority 1000 is used to create the program file (client AP11 and communication Module 1
A digital signature (encryption) is performed in 2). Specifically, an encrypted digital signature is generated and attached to each program file.

In step S37, these files are stored in the web server 1. FIG. 5 shows a client AP 11 and a client AP obtained by digitally signing the client AP 11.
111 is shown.

To start the business process in the client device 2, the client device 2 downloads both digitally signed program files from the web server 1 (step S39). The downloaded client AP is denoted by reference numeral 111A.

In step S41, the web browser 21 authenticates each program file.
Specifically, using the public key A stored in the keystore file 21b, an attempt is made to decrypt the digital signature in each program file. Here, if the decryption can be executed without any problem, it means that these program files have been authenticated as legitimate ones usable in the C / S system of this embodiment.

For example, even if a program file other than the client AP 111 is downloaded, the above-described decryption is impossible, and thus such file is not authenticated.

Therefore, according to the client-server system according to the second embodiment of the present invention, the program file for the client device is encrypted so that it can be decrypted by the client device, so that the file created illicitly. For example, it is possible to prevent falsification of the setting contents and data of the client device.

It should be noted that the client AP 11 or 111 may be recorded on a computer-readable recording medium so that the client AP 11 or 111 can be distributed or carried, and the same effects as those of the above-described embodiment may be obtained at any place. Note that this recording medium includes a generally-distributable or portable medium such as a semiconductor memory, an optical disk, a magnetic disk, a magneto-optical disk, a floppy disk, and a magnetic tape.

[0053]

As described above, according to the first aspect of the present invention,
According to the client server system according to the first aspect, the communication with the business server is performed directly by using the obtained client device program file and communication module. High-speed communication equivalent to the system can be realized.

Further, according to the client server system of the second aspect of the present invention, the program file for the client device releases the restriction on the communication path, so that the communication with the business server can be performed directly.

According to the client server system of the third aspect of the present invention, since the program file for the client device is encrypted, it is possible to prevent the setting contents and data stored in the client device from being falsified. it can.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a client server system to which a first embodiment of the present invention has been applied.

FIG. 2 is a diagram showing a description example of a security information file shown in FIG. 1;

FIG. 3 is a flowchart showing a flow of processing in the embodiment shown in FIG. 1;

FIG. 4 is a sequence diagram illustrating a flow of processing according to a second embodiment of the present invention.

FIG. 5 is a diagram for explaining a flow of information on a network in the mode shown in FIG. 4;

FIG. 6 is a diagram showing a configuration of a conventional client server system.

[Explanation of symbols]

 1 Web Server 11, 11A, 111, 111A Client AP 11a Initialization Processing Unit 11b Application Execution Unit 12, 12A, 32 Communication Module 2 Client Device 21 Web Browser 21a Security Information File 21b Key Store File 3 Business Server 31 Server AP

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Hiroki Yamazaki 1-9-1, Konan, Minato-ku, Tokyo NTT Communicationware Co., Ltd. (72) Inventor Masakazu Kobayashi, Konan-ichi Minato-ku, Tokyo No. 9-1, NTT Communicationware Co., Ltd. (72) Inventor Noriyuki Kiriyama, 9-1-1, Konan, Minato-ku, Tokyo, Japan Inside of NTT Communicationware Co., Ltd. (72) Inventor Tatsuya Akiyama 9-1-1 Konan, Minato-ku, Tokyo NTT Communicationware Co., Ltd. F-term (reference) 5B045 BB11 BB47 GG01 HH02 5B076 BB06 5B089 GA11 GA21 GB04 JB07 KA05 KB04 KC54 KG04 KG05 KH30

Claims (3)

[Claims] 1. A web server having a program file and a communication module for a client device, and at least a web browser, and a program file and a communication module for a client device are obtained from the web server as appropriate. A client server system comprising: a client device that directly communicates with a predetermined business server using a program file and a communication module. 2. The client server system according to claim 1, wherein the program file for the client device releases a restriction on a communication path limited to the route via the web server. 3. The client server system according to claim 1, wherein the client device program file is encrypted so as to be decryptable in the client device.